Authentication basis configuration method, device and system, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data processing, in particular to an authentication basis configuration method, device and system, electronic equipment and a storage medium, and the method comprises the steps that first equipment providing a first service obtains an executable file and a security configuration file associated with the first service in response to a release instruction of service release equipment for the first service, and a first authentication basis; then, the first equipment runs the executable file, and sends a security configuration file and a target signature result generated based on the first authentication basis to the security management equipment; after the security management equipment completes signature verification of the target signature result based on the security configuration file and the stored corresponding relation, receiving a second authentication basis which is sent by the security management platform and is used for authenticating the service calling permission of the second service; wherein the first service is configured to be invoked by the second service. Therefore, the reliability of authentication between services is improved, and the security of the authentication basis configuration process is guaranteed.

Description

Background Art

[0002] In the deployment mode of the service network, the cooperation of multiple services is usually required to complete business processing. Therefore, assuming that two services with a calling relationship are the first service and the second service, then the second service can call the first service to participate in business processing after completing the authentication verification of the first service with the help of the authentication basis.

[0003] Taking payment services as an example, during the processing of payment services, the first service is the bank transfer service, and the second service is the payment order service; therefore, after the payment order service completes the authentication verification of the bank transfer service with the help of the authentication basis, it can call the bank transfer service to participate in the payment processing.

[0004] Currently, when configuring the authentication basis between two services, a centralized security management device usually configures the authentication basis for different services separately, and when the second service calls the first service, the authentication basis configured for the second service is used to complete the authentication verification of the second service for the first service.

[0005] However, since the authentication basis between services is directly configured by the security management device, the security of the service that obtains the authentication basis cannot be guaranteed, which makes the authentication basis at risk of being configured for abnormal services. Therefore, the security of the authentication basis configuration process cannot be guaranteed, which reduces the reliability of authentication between services. Summary of the invention

[0006] The embodiments of the present application provide a method, device, system, electronic device and storage medium for obtaining authentication basis, so as to improve the security of the configuration process of the authentication basis.

[0007] In a first aspect, a configuration method of an authentication basis is provided, which is applied to a first device providing a first service, comprising:

[0008] In response to a release instruction from a service publishing device for the first service, an executable file and a security configuration file associated with the first service are obtained, as well as a first authentication basis configured for the first service and used to identify the service call authority of the first service; wherein the security configuration file is constructed by a security management device based on a development description information set sent by the service publishing device;

[0009] Running the executable file, and sending the security configuration file and the target signature result generated based on the first authentication basis to the security management device;

[0010] After the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis, the second authentication basis sent by the security management device is received for identifying the service calling authority of the second service; wherein the first service is configured to be called by the second service.

[0011] In the second aspect, a configuration method of authentication basis is proposed, which is applied to security management equipment, including:

[0012] Obtaining a first authentication basis and a development description information set sent by a service publishing device for a first service, storing a corresponding relationship between the development description information set and the first authentication basis, and feeding back a security profile constructed based on the development description information set to the service publishing device;

[0013] receiving a target signature result and the security configuration file generated based on the first authentication basis and sent by the first device when the first device runs the executable file associated with the first service;

[0014] Obtaining a candidate signature result according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship;

[0015] When it is determined that the signature verification between the candidate signature result and the target signature result is successful, a second authentication basis of a second service that calls the first service is sent to the first device.

[0016] In a third aspect, a configuration system for authentication basis is proposed, the configuration system comprising: a first device providing a first service, a service publishing device, and a security management device;

[0017] The service publishing device is used to send a first authentication basis and a development description information set configured for a first service for identifying the service calling authority of the first service to the security management device, and publish the executable file associated with the first service and the security configuration file generated by the security management device to the first device;

[0018] The first device is configured to run the executable file, send the security configuration file and the target signature result generated based on the first authentication basis to the security management device, and receive a second authentication basis for authenticating the service calling authority of the second service sent by the security management device after completing the signature verification, wherein the second service is configured to be called by the first service;

[0019] The security management device is used to store the correspondence between the development description information set and the first authentication basis, and to feed back a security profile constructed based on the development description information set to the service publishing device; obtain a candidate signature result based on the first authentication basis determined by the development description information set in the security profile and the correspondence, and determine the second authentication basis for the second service after completing the signature verification of the candidate signature result and the target signature result.

[0020] In a fourth aspect, a configuration device for authentication basis is provided, comprising:

[0021] A response unit, configured to obtain, in response to a release instruction of the service publishing device for the first service, an executable file and a security configuration file associated with the first service, and obtain a first authentication basis configured for the first service for identifying the service call authority of the first service; wherein the security configuration file is constructed by the security management device based on the development description information set sent by the service publishing device;

[0022] An operating unit, configured to operate the executable file and send the security configuration file and a target signature result generated based on the first authentication basis to the security management device;

[0023] A receiving unit is used to receive a second authentication basis sent by the security management device for identifying the service calling authority of the second service after the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis; wherein the first service is configured to be called by the second service.

[0024] Optionally, after running the executable file, or after receiving the second authentication basis sent by the security management platform for verifying the calling authority of the second service, the device further includes an execution unit, and the execution unit is used to:

[0025] Execute a first service for object business data associated with the target object to obtain intermediate business data, and determine a third service for processing the intermediate business data in combination with a preset business service process;

[0026] A signature algorithm built into the executable file associated with the first service is used to generate a first signature result based on the first authentication basis and the request body constructed according to the intermediate business data, and the request header containing the first signature result and the request body are concatenated to obtain a request to be processed, and the request to be processed is sent to a third device that provides the third service.

[0027] Optionally, after receiving the second authentication basis sent by the security management device for identifying the calling authority of the second service, the apparatus further includes a processing unit, the processing unit being configured to:

[0028] receiving a service processing request sent by a second device providing the second service; wherein the request header of the service processing request includes: a second signature result generated based on the second authentication information and the request body of the service processing request using a signature algorithm built into an executable file of the second service;

[0029] Using the signature algorithm built into the executable file of the first service, based on the request body in the business processing request and the stored second authentication basis, to generate a signature result to be verified;

[0030] When it is determined that the signature verification between the second signature result and the signature result to be verified is successful, business processing is performed on the business data to be processed in the request body.

[0031] Optionally, when obtaining the first authentication basis configured for the first service and used to identify the service calling authority of the first service, the response unit is used to perform any one of the following operations:

[0032] Obtaining a first authentication basis generated by the service publishing device after hashing the executable file;

[0033] A hash process is performed on the executable file to obtain a first authentication basis for the first service.

[0034] Optionally, when the executable file is run to send the security configuration file and the target signature result generated based on the first authentication basis to the security management device, the running unit is used to:

[0035] Running the executable file, starting the first service process, and generating a target signature result based on the first authentication basis according to a built-in signature algorithm;

[0036] An interactive process for communicating with the security management device is started, and the security configuration file and the target signature result are sent to the security management device through the interactive process.

[0037] In a fifth aspect, a configuration device for authentication basis is proposed, comprising:

[0038] An acquisition unit, configured to acquire a first authentication basis and a development description information set sent by a service publishing device for a first service, store a correspondence between the development description information set and the first authentication basis, and feed back a security profile constructed based on the development description information set to the service publishing device;

[0039] a receiving unit, configured to receive a target signature result and the security configuration file generated based on the first authentication basis and sent by the first device when the first device runs the executable file associated with the first service;

[0040] an obtaining unit, configured to obtain a candidate signature result according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship;

[0041] The determining unit is configured to send a second authentication basis of a second service that calls the first service to the first device when it is determined that the signature verification between the candidate signature result and the target signature result is successful.

[0042] Optionally, when feeding back the security configuration file constructed based on the development description information set to the service publishing device, the acquiring unit is used to:

[0043] Generate a tamper-proof signature based on private key information and the development description information set, and generate a security configuration file based on the tamper-proof signature and the development description information set;

[0044] Feedback the security configuration file to the service publishing device.

[0045] Optionally, when obtaining the candidate signature result according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship, the acquisition unit is used to:

[0046] Using the public key information corresponding to the private key information, verifying the tamper-proof signature in the security configuration file, and when determining that the development description information set has not been tampered with according to the verification result, obtaining a first authentication basis according to the development description information set and the corresponding relationship;

[0047] A built-in signature algorithm is used to generate a candidate signature result based on the first authentication basis.

[0048] Optionally, after determining that the signature verification between the candidate signature result and the target signature result is successful, before sending the second authentication basis of the second service that calls the first service to the first device, the apparatus further includes a search unit, wherein the search unit is configured to perform any one of the following:

[0049] In the stored service call relationships, searching for a target service relationship associated with the first service when the first service is used as a called service;

[0050] The first service is pulled from an authentication management device used to manage service calling relationships as a target service relationship associated with the called service.

[0051] In a sixth aspect, an electronic device is proposed, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0052] In a seventh aspect, a computer-readable storage medium is proposed, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0053] In an eighth aspect, a computer program product is proposed, comprising a computer program, wherein the computer program implements the above method when executed by a processor.

[0054] The beneficial effects of this application are as follows:

[0055] The present application proposes a configuration method, apparatus, system, electronic device and storage medium for authentication basis, and proposes that in the configuration process of authentication basis, a first device providing a first service obtains an executable file and a security configuration file associated with the first service in response to a release instruction of a service publishing device for the first service, and obtains a first authentication basis configured for the first service for identifying the service call authority of the first service, wherein the security configuration file is constructed by a security management device based on a development description information set sent by the service publishing device; therefore, the first authentication basis is obtained at the service publishing stage, which is equivalent to completing the configuration of the authentication basis when the service is deployed, and the authentication basis is not configured by the security management device, which greatly reduces the excessive dependence on the security management device during the configuration process of the authentication basis and reduces the centralization risk of the security management device;

[0056] Afterwards, the first device runs the executable file and sends the security configuration file and the target signature result generated based on the first authentication basis to the security management device; after the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis, it receives the second authentication basis sent by the security management platform for identifying the service call authority of the second service; wherein the first service is configured to be called by the second service.

[0057] In this way, since the second authentication basis obtained by the first device is sent by the security management device after completing the signature verification of the first device based on the first authentication basis and determining that the second service can call the first service, the identity authentication of the first service on the first device is completed before the authentication basis is sent, which is equivalent to verifying the legitimacy and security of the first service requesting the authentication basis. Therefore, it can avoid the authentication basis from being configured for abnormal services, improve the reliability of authentication between services, and ensure the security of the authentication basis configuration process. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of the configuration process of the authentication basis under the relevant technology in the embodiment of the present application;

[0059] Figure 2 A schematic diagram of a configuration system for authentication according to an embodiment of the present application;

[0060] Figure 3 A schematic diagram of an interactive device during a service call in an embodiment of the present application;

[0061] Figure 4 A schematic diagram of an interactive device when another service is called in an embodiment of the present application;

[0062] Figure 5 A schematic diagram of a configuration process of an authentication basis executed by a first device in an embodiment of the present application;

[0063] Figure 6 This is a schematic diagram of the publishing process of the first service in an embodiment of the present application;

[0064] Figure 7 A schematic diagram of a process in which a first device obtains authentication basis in an embodiment of the present application;

[0065] Figure 8 This is a schematic diagram of the authentication process between services in an embodiment of the present application;

[0066] Fig. 9 A schematic diagram of the configuration process of the authentication basis executed by the security management device in the implementation of this application;

[0067] Fig.10 A schematic diagram of the interaction process when configuring the authentication basis in an embodiment of the present application;

[0068] Fig.11 A schematic diagram of the interactive process of service authentication in an embodiment of the present application;

[0069] Fig.12 A schematic diagram of the logical structure of a configuration device for authentication basis in an embodiment of the present application;

[0070] Fig.13 A schematic diagram of the logical structure of another configuration device for authentication basis in an embodiment of the present application;

[0071] Fig.14 A schematic diagram of the hardware structure of an electronic device to which the present invention is applied;

[0072] Fig.15 The present invention is a schematic diagram of the hardware structure of another electronic device to which the embodiments of the present application are applied. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0074] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.

[0075] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0076] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0077] Public Key Infrastructure (PKI): a security framework for managing and distributing digital certificates and keys; it mainly includes public and private key cryptography, x509 certificates, and (Certificate Authority, CA) certificate issuing centers, etc.

[0078] Certificate: In the PKI system, a certificate is the identity proof of a public key owner and is issued by an authoritative organization. Moreover, asymmetric encryption and digital signatures for information can be implemented based on the public key certificate system.

[0079] Authentication: used to verify whether one has the authority to apply for services or obtain resources.

[0080] Authentication basis: also known as identity authentication factor, refers to the content based on which the authentication process is based.

[0081] Authentication: In the present application embodiment, it refers to the legal identity used to perform the service resolution.

[0082] Authorization: In the embodiments of the present application, it refers to the right performed between services, indicating that one service can call another service to participate in business processing.

[0083] Verification: refers to the process of checking the accuracy and consistency of the data obtained to ensure that the data obtained complies with the rules.

[0084] The following is a brief introduction to the design concept of the embodiment of the present application:

[0085] In the service mesh (Istio) deployment mode, the service authentication process of the zero-trust system usually involves the processing of the root certificate authority (CA), the control plane, and the data plane. The root certificate authority is responsible for managing keys and certificates; the control plane processing includes: managing security policies and certificates, implementing the issuance of certificates and the definition of authentication policies, and interacting with basic devices (such as the Kubernetes API Server), and sending the configured data to the data plane; the data plane processing includes: identifying and executing identity authentication, encryption, and policy parsing.

[0086] In the data plane processing, when business processing is completed with the help of multiple services, in order to ensure the coordination between the services, it is usually necessary to perform authentication between two services that have a calling relationship; therefore, assuming that the two services that have a calling relationship are the first service and the second service, then after the second service completes the authentication verification of the first service with the help of the authentication basis, it can call the first service to participate in business processing.

[0087] See also Figure 1 As shown, it is a schematic diagram of the configuration process of the authentication basis under the relevant technology in the embodiment of this application. Figure 1 , explain the relevant configuration process:

[0088] Step 101: A first device providing a first service requests a security management device to provide authentication basis.

[0089] Step 102: The security management device feeds back the authentication basis configured specifically to the first device providing the first service.

[0090] Step 103: The first device providing the first service sends a service invocation request carrying an authentication basis to the second device providing the second service.

[0091] Step 104: The second device providing the second service requests the security management device to verify the validity of the authentication basis provided by the first device.

[0092] Step 105: The security management device sends a valid authentication result indicating the authentication basis to the second device providing the second service.

[0093] Specifically, the security management device can verify the validity of the authentication basis provided by the second service based on the stored service calling relationship and the authentication basis configured for the first service, and feed back the authentication result to the second device providing the second service.

[0094] Step 106: The second device providing the second service feeds back a processing result to the first device providing the first service.

[0095] Combined with Figure 1 From the illustrated authentication basis configuration process, it can be seen that the existing processing method is generally to manage the authentication basis through a centralized security management device. Moreover, the service relies on communication with the security management device to complete the authentication, and the secure configuration of the authentication basis cannot be guaranteed, which makes the authentication basis at risk of being configured to abnormal services, making it difficult to ensure the security of the authentication basis configuration process, reducing the reliability of authentication between services; moreover, the lack of protection for the authentication basis between services will lead to the leakage of the calling relationship between services, which is very likely to bring risks to the normal service process. In addition, since the authentication basis and the authentication process are both implemented around the security management device, there is a problem of over-centralization, which makes the configuration process of the authentication basis very limited to the normal processing of the security management device.

[0096] In view of this, the present application proposes a configuration method, apparatus, system, electronic device and storage medium for authentication basis, and proposes that in the configuration process of authentication basis, a first device providing a first service obtains an executable file and a security configuration file associated with the first service in response to a release instruction of a service publishing device for the first service, and obtains a first authentication basis configured for the first service for identifying the service call authority of the first service, wherein the security configuration file is constructed by a security management device based on a development description information set sent by the service publishing device; therefore, the first authentication basis is obtained at the service publishing stage, which is equivalent to completing the configuration of the authentication basis when the service is deployed, and the authentication basis is not configured by the security management device, which greatly reduces the excessive dependence on the security management device during the configuration process of the authentication basis, and reduces the centralization risk of the security management device;

[0097] Afterwards, the first device runs the executable file and sends the security configuration file and the target signature result generated based on the first authentication basis to the security management device; after the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis, it receives the second authentication basis sent by the security management platform for identifying the service call authority of the second service; wherein the first service is configured to be called by the second service.

[0098] In this way, since the second authentication basis obtained by the first device is sent by the security management device after completing the signature verification of the first device based on the first authentication basis and determining that the second service can call the first service, the identity authentication of the first service on the first device is completed before the authentication basis is sent, which is equivalent to verifying the legitimacy and security of the first service requesting the authentication basis. Therefore, it can avoid the authentication basis from being configured for abnormal services, improve the reliability of authentication between services, and ensure the security of the authentication basis configuration process.

[0099] From the perspective of the security management device, the security management device obtains the first authentication basis and development description information set sent by the service publishing device for the first service, stores the correspondence between the development description information set and the first authentication basis, and feeds back a security profile built based on the development description information set to the service publishing device; then receives the target signature result and security profile generated based on the first authentication basis and sent by the first device when running the executable file associated with the first service; thereafter, obtains the candidate signature result based on the first authentication basis determined by the development description information set and the correspondence in the security profile; and further, when it is determined that the signature verification between the candidate signature result and the target signature result is successful, the second authentication basis of the second service configured to be called by the first service is sent to the first device.

[0100] In this way, the security management device completes the signature verification of the first service on the first device based on the first authentication basis, and after determining that the second service can call the first service, it feeds back the second authentication basis to the first device. Therefore, before sending the authentication basis, the identity authentication of the first service on the first device is completed, which is equivalent to verifying the legitimacy and security of the first service requesting the authentication basis. Therefore, it can avoid the authentication basis from being configured to the device where the abnormal service is located, thereby improving the reliability of authentication between services and ensuring the security of the authentication basis configuration process.

[0101] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments of the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0102] See also Figure 2 As shown, it is a schematic diagram of an interactive scenario of an authentication basis configured in an embodiment of the present application. The schematic diagram of the configuration system of the authentication basis includes a service publishing device 210, a first device 220 providing a first service, a second device 230 providing a second service, and a security management device 230; wherein, taking the second service being able to call the first service as an example, the devices and processes involved in configuring the authentication basis for the first device providing the first service are described:

[0103] Service publishing device 210: used to send the first authentication basis and development description information set configured for the first service for identifying the service call authority of the first service to the security management device, and publish the executable file associated with the first service and the security configuration file generated by the security management device to the first device.

[0104] The first device 220: is used to run the executable file, send a security configuration file and a target signature result generated based on the first authentication basis to the security management device, and receive a second authentication basis sent by the security management device after completing the signature verification, which is used to identify the service calling authority of the second service, wherein the second service is configured to be called by the first service.

[0105] Security management device 240: used to store the correspondence between the development description information set and the first authentication basis, and to feed back to the service publishing device a security profile constructed based on the development description information set; and, based on the first authentication basis determined by the development description information set in the security profile and the correspondence, obtain a candidate signature result, and after completing the signature verification of the candidate signature result and the target signature result, determine the second authentication basis for the second service.

[0106] It should be noted that in some feasible application scenarios of the present application, the security management device 240 can pre-store the service call relationship between services; in other feasible application scenarios of the present application, the security management device 240 can, with the help of the provided authentication management terminal, receive the service call relationship configured by the developer on the development device at any time, and store the configured service call relationship; in some other feasible application scenarios of the present application, the authentication management device, with the help of the authentication management terminal, receives the service call relationship configured by the developer on the development device at any time, stores the configured service call relationship, and provides service call relationship according to the pull request of the security management device 240.

[0107] For example, after the developer of service A installs the authentication management end on the development device, he can configure the interface for accessing service B and configure the call of the running service A (i.e., service process A) to the running service B (i.e., service process B), so that a corresponding authorization rule record can be stored in the database on the security management device, representing the service call relationship between service A and service B, where the authentication management end can be any one of a mini-program application, a client application, and a web application.

[0108] In this way, the first authentication basis for identifying the service calling authority of the first service is sent by the service publishing device to the security management device for storage before the service publishing device publishes the first service, so that when the authentication basis is configured for the first device providing the first service, the security management device completes the authentication verification of the first device based on the first authentication basis, and then configures the second authentication basis of the second service to the first service on the first device, so that the first service (or first service process) can perform service authentication based on the second authentication basis when receiving a service call request from the second service (or second service process).

[0109] Similarly, when configuring the authentication basis for the second device providing the second service, the second device 230 is used to run the executable file associated with the second service published by the service publishing device, start the second service process, send the security configuration file of the second service and the signature result generated based on the second authentication basis of the second service to the security management device, and receive the authentication basis sent by the security management device after completing the signature verification, which is used to identify the calling authority of other services to the second service.

[0110] It should be noted that the first device can store the second authentication basis of the second service in the memory, so that the corresponding second authentication basis can be determined by the service name of the second service. Similarly, the second device can store the service names of other services and the corresponding authentication basis in the memory.

[0111] In the embodiment of the present application, in other feasible embodiments of the present application, the service publishing device 210 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0112] Similarly, the first device 220 providing the first service and the second device 230 providing the second service can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms; or, it can be other electronic devices that can provide services.

[0113] The security management device 240 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0114] See also Figure 3 As shown, it is a schematic diagram of an interactive device when a service is called in an embodiment of the present application. The following takes the case where the business processing needs to be processed by the second service and the first service, and the second service needs to call the first service to complete the processing as an example to illustrate the possible interaction scenario:

[0115] In the process of the second device providing the second service calling the first service, the second device is used to execute the second service for the object business data associated with the target object after completing the configuration of the authentication basis for the second service, obtain the business data to be processed, and determine the first service for processing the business data to be processed in combination with the preset business service process; then use the signature algorithm built into the executable file associated with the second service to generate a second signature result based on the corresponding second authentication basis and the request body constructed according to the business data to be processed, and concatenate the request header and request body containing the second signature result to obtain a business processing request, and send the business processing request to the first device.

[0116] Among them, in a feasible business scenario, the object business data can be generated on the client device 330; the processing process performed by the first device during the service call will be described in detail later when the processing is described from the perspective of the first device; the way in which the second device providing the second service configures the authentication basis is the same as the way in which the first device providing the first service completes the authentication basis configuration, and will not be elaborated here.

[0117] It should be understood that according to the authentication configuration process proposed in this application, calling permissions can be verified between any two service processes that have a calling relationship, so that the called process can verify the calling permissions of the calling process, wherein the calling process and the called process run on different devices.

[0118] The client device 330 includes but is not limited to mobile phones, tablet computers, notebooks, e-book readers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc.

[0119] It should be understood that, for the processing of a business, the services that need to be passed through in the business service process and the execution order of each service are pre-configured; therefore, for the second service, after the second service is completed, according to the actual processing needs, it can be based on the internally configured service execution order, or it can be based on the service execution order indicated by the external device, to determine the first service that needs to be executed and the first device that provides the first service, where the external device can be a management device for business management.

[0120] For example, in a feasible implementation, after completing the planning of the business service process, the business developers can allocate the services that can be run by each device and determine the execution order of each service in the business service process. Then, in the executable file associated with the service, they can configure the services that need to be called and the device information of the device providing the service, so that after completing the service authentication, one service can call another service to assist in business processing.

[0121] For another example, in a feasible implementation, a business management device may be configured for a business service process so that the business management device can manage the device providing the service and provide the device providing the service with device information of other services called.

[0122] It should be noted that the signature algorithms built into the executable files associated with different services, as well as the built-in signature algorithms used by the security management device to sign the obtained authentication basis, are the same. This ensures that the second signature result obtained by the first device after authentication based on the obtained second authentication basis by executing the executable file of the first service is the same as the signature result obtained by the second device based on the same second authentication basis by executing the executable file of the second service.

[0123] In addition, it should be understood that the request header usually includes a series of key-value pairs for transmitting additional information about the request, and the request body usually contains the actual data sent; based on this, the second signature result can be included in the request header.

[0124] In this way, from an overall perspective, when the second service on the second device calls the first service on the first device, it needs to generate a second signature result based on its own second authentication basis, and send a business processing request containing the second signature result to the first device, so that after the first device obtains the second signature result, it can verify the second signature result to determine the second service's calling authority for the first service, and when it is determined that the calling authority exists, process the object business data provided by the second device, which greatly improves the security of the service calling process.

[0125] See also Figure 4 As shown, it is a schematic diagram of an interactive device when another service is called in an embodiment of the present application. The following takes the case where the business service process needs to be processed by the second service, the first service, and the third service, and the second service needs to call the first service, and the first service needs to call the third service as an example to illustrate the possible interaction scenario:

[0126] The second service calls the first service, as described above. Figure 3 Similarly, for the first service provided by the first device, in a feasible implementation, the first service may have the right to call the third service while receiving the call from the second service. Based on this, when calling the third service to assist in business processing, there is also a third device 340 providing the third service in the interaction scenario.

[0127] The third device 340 providing the third service is used to receive the request to be processed sent by the first device after completing the configuration of the authentication basis for the third service; wherein the request header of the request to be processed includes: using the signature algorithm built into the executable file of the first service to generate a first signature result based on the first authentication information and the request body of the request to be processed; using the signature algorithm built into the executable file of the third service to generate a signature result to be verified based on the request body and the stored first authentication basis; and when it is determined that the signature verification between the first signature result and the signature result to be verified is successful, business processing is performed on the intermediate business data in the request body.

[0128] The manner in which the third device providing the third service performs authentication basis configuration is the same as the manner in which the first device providing the first service completes authentication basis configuration, and will not be elaborated herein.

[0129] In this way, after receiving the pending request sent by the first device, the third device needs to authenticate the calling authority of the first service on the first device based on the first signature result carried in the pending request header, thereby enhancing the security of the service calling process.

[0130] Similar to the first device and the second device, the third device can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms; or, it can be an electronic device that provides services.

[0131] It should be noted that, in the embodiments of the present application, Figure 2-4 In the present application, some feasible interaction scenarios are proposed. It should be understood that this application only provides a schematic illustration of the total number of services provided. In a feasible implementation, there may be collaborative processing of multiple services in a business service process. This application specifically limits the total number of different services.

[0132] In addition, for the attached Figure 2-4 As for the devices involved, when data is exchanged between devices, a communication connection can be established with the help of a wired network or a wireless network according to actual processing needs. This application does not impose any specific restrictions on this. Moreover, in order to ensure the security of data transmission, a trusted transmission method can be used for data transmission in an intranet environment, and a specified protocol can be used in an extranet environment, such as HyperText Transfer Protocol Secure (HTTPS) for data transmission.

[0133] The following is a schematic illustration of the configuration process of the authentication basis based on possible application scenarios:

[0134] Application scenarios, configuration of authentication basis during service release phase.

[0135] Specifically, taking the release of the first service as an example, when configuring the authentication basis in the service release stage, the service release device sends the first authentication basis and the development description information set of the first service to the security management device before releasing the first service, so that the security management device stores the correspondence between the development description information set of the first service and the first authentication basis, and feeds back the security configuration file generated based on the development description information to the service development device.

[0136] Afterwards, when the service development device publishes the first service to the first device, the executable file and the security configuration file associated with the first service are sent to the first device, so that the first device can obtain the first authentication basis for identifying the service calling authority of the first service.

[0137] Furthermore, the first device starts the first service process by running the executable file associated with the first service, and sends the security configuration file and the target signature result generated based on the first authentication basis to the security management device. After that, the security management device completes the signature verification of the target signature result based on the security configuration file, and when it is determined that the second service can call the first service, it feeds back to the first device the second authentication basis for identifying the service calling authority of the second service.

[0138] In addition, it should be understood that in the specific implementation of this application, the configuration process of the authentication basis is involved. When the embodiments recorded in this application are applied to specific products or technologies, the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0139] In conjunction with the accompanying drawings, from the perspective of a device providing a service, assuming that a first device provides a first service, the configuration process of the authentication basis is described below:

[0140] See also Figure 5 As shown, it is a schematic diagram of the configuration process of the authentication basis executed by the first device in the embodiment of the present application. Figure 5 , the configuration process of the authentication basis is explained:

[0141] Step 501: In response to a publishing instruction for a first service from a service publishing device, a first device obtains an executable file and a security configuration file associated with the first service, and obtains a first authentication basis configured for the first service for authenticating service call authority of the first service.

[0142] After the service publishing device instructs the first service to be published, the first device obtains the executable file and security configuration file associated with the first service, wherein the security configuration file is constructed by the security management device based on the development description information set sent by the service publishing device; the information included in the development description information set may include: service name, service version, file path, file name, etc.

[0143] It should be noted that the executable file associated with the first service is a binary file compiled by the service publishing device after integrating the software development kit (SDK) that implements the authentication function in the first service; according to actual processing needs, the security configuration file includes a development description information set of the first service, and a tamper-proof signature obtained by the security management device after private key signing based on the development description information set.

[0144] When the first device obtains the first authentication basis configured for the first service, in some feasible implementations, the first authentication basis can be obtained directly from the service publishing device; in other feasible implementations, the first authentication basis generated based on the executable file in the same way as the service publishing device generates the first authentication basis can be obtained.

[0145] Based on this, when the first device obtains the first authentication basis configured for the first service and used to identify the service call authority of the first service, the first device can obtain the first authentication basis generated after hashing the executable file of the service publishing device; or, the first device can hash the executable file associated with the first service to obtain the first authentication basis for the first service.

[0146] For example, when obtaining the first authentication basis of the first service, the executable file associated with the first service may be hashed to obtain a hash value, and the hash value is used as the first authentication basis of the first service.

[0147] In this way, the first device can directly obtain the first authentication basis from the service publishing device according to actual configuration needs, or generate the first authentication basis itself based on the executable file associated with the obtained first service, which greatly enhances the flexibility of obtaining the first authentication basis.

[0148] Step 502: The first device runs the executable file and sends a security configuration file and a target signature result generated based on the first authentication basis to the security management device.

[0149] When executing step 502, the first device runs the executable file associated with the first service, starts the first service process, and generates a target signature result based on the first authentication basis according to the built-in signature algorithm; then, starts an interactive process for communicating with the security management device, and sends the security configuration file and the target signature result to the security management device through the interactive process.

[0150] Specifically, the first device can start the first service process by running the executable file associated with the first service, thereby providing the first service to the outside. Moreover, when the first service process is started, the first device needs to interact with the security management device to obtain the process authentication of the first service process by the security management device, or it can be understood as obtaining the identity authentication of the first service by the security management device.

[0151] It should be noted that when the first device generates the target signature result, the signature algorithm used is built into the executable file of the first service; and, according to actual processing needs, the signature algorithm used to generate the target signature result can specifically be a white-box signature algorithm, wherein the white-box signature algorithm embeds the signature algorithm and the key into the program code, making it difficult to extract the key during runtime; for the started interactive process, the interactive process is responsible for communicating with the security management device, and pulling the authentication basis of other services that need to call the first service from the security management device, and providing the obtained authentication basis to the first service process.

[0152] In addition, in an embodiment of the present application, when the first device generates a target signature result based on the first authentication basis, in some feasible implementation methods, the built-in signature algorithm can be directly used to generate the target signature result according to the first authentication basis; in other feasible implementation methods, the built-in signature algorithm can be used to generate the target signature result based on the first authentication basis and additional information, wherein the additional information can be any one or a combination of timestamp information, service name, etc.; the service name is included in the development description information set associated with the first service; when the signature result is generated in combination with the timestamp information, the timestamp information based on it needs to be informed to the security management device.

[0153] In this way, by means of the interactive process, when the first device starts the first service process, the information based on the process authentication can be sent to the security management device, thereby ensuring the smooth progress of the authentication process.

[0154] Step 503: After the first device completes the signature verification of the target signature result in the security management device based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis, the first device receives the second authentication basis sent by the security management device for identifying the service call authority of the second service; wherein the first service is configured to be called by the second service.

[0155] Specifically, after the security management device completes the signature authentication of the target signature result based on the security configuration file, and the correspondence between the stored development description information set and the first authentication basis, it can be determined that the process authentication for the first service process has been completed, or, in other words, the identity authentication for the first service has been completed; thereafter, the first device can receive the second authentication basis sent by the security management device for identifying the service call authority of the second service.

[0156] Among them, the second authentication basis is sent after the security management device completes the signature verification and determines, based on the obtained service call relationship, that the second service has the authority to call the first service; in addition, the signature authentication and authentication basis search process performed by the security management device will be described in detail in the subsequent description from the perspective of the security management device.

[0157] See also Figure 6 As shown, it is a schematic diagram of the publishing process of the first service in the embodiment of the present application. Figure 6 It can be seen from the schematic content that before the service publishing device publishes a program for the first service, it first uses the interactive interface between the service publishing device and the security management device to send the first authentication basis (such as a process hash) generated for the first service and the development description information set to the security management device, so that the security management device can store the authentication elements for identifying the service identity (or service process identity); then, the service publishing device publishes the program for the first service and publishes the first service to the first device.

[0158] See also Figure 7 As shown, it is a schematic diagram of the process of the first device obtaining the authentication basis in the embodiment of the present application. Figure 7 As can be seen from the schematic content, developers can use the authentication management end to configure the rules for the second service to call the first service, and then the authentication management end stores the service call relationship of the second service to the first service in the associated service relationship database, wherein the authentication management end can be a function provided to the outside by the security management device, or the authentication management end can be a function provided by an independent authentication management device; after the first service process is started on the first device, the first service process sends a process authentication request to the security management device, and after the security management device completes the process authentication, it obtains the second authentication basis for the second service sent by the security management device.

[0159] Furthermore, after receiving the second authentication basis sent by the security management device for identifying the calling authority of the second service, when the first service process accepts the call of the second service process to perform business processing, the first device can receive the business processing request sent by the second device providing the second service; wherein the request header of the business processing request includes: a second signature result generated based on the second authentication information and the request body of the business processing request using the signature algorithm built into the executable file of the second service; further, the first device uses the signature algorithm built into the executable file of the first service to generate a signature result to be verified based on the request body in the business processing request and the stored second authentication basis; thereafter, when it is determined that the signature verification between the second signature result and the signature result to be verified is successful, business processing is performed on the business data to be processed in the request body.

[0160] Specifically, when performing signature verification, since the built-in signature algorithms in the executable files of different services are the same, the signature results obtained are the same when the adopted signature algorithms and the contents of the signature basis are consistent; therefore, after obtaining the business processing request, the first device can use the built-in signature algorithm to generate a signature result to be verified based on the second authentication basis obtained from the security management device and the request body of the business processing request; and then when it is determined that the signature result to be verified is the same as the second signature result, it can be determined that the signature verification is successful, so business processing can be performed on the business data to be processed contained in the business processing request.

[0161] It should be noted that, when generating a signature result to be verified based on the request body in the business processing request and the stored second authentication basis, according to actual processing needs, a built-in signature algorithm can be used to generate a second signature result based on the hashed request body, i.e., the request body hash, the second authentication basis, and additional information. The additional information can be configured according to actual processing needs, for example, it can be empty, or it can be a service name.

[0162] For example, see Figure 8 As shown, it is a schematic diagram of the authentication process between services in the embodiment of the present application. Figure 8 It can be seen from the illustrated content that after the first service process on the first device and the second service process on the second device complete the process authentication of the security management device, the second service process on the second device can build a request body based on the business data to be processed when it needs to call the first service for auxiliary processing, and generate a second signature result based on the request body hash, the second authentication basis, and the service name corresponding to the second service process, and then place the second signature result in the request header, and send the business processing request obtained by combining the request header and the request body to the first service process on the first device.

[0163] In this way, after receiving the business processing request sent by the second device, the first device can determine whether the second service process that triggers the business processing request has the authority to call the first service process, and determine to process the business processing request. In this way, the authentication process is completed by the first device, and there is no need for service authentication by the security management device. Therefore, the service authentication process can be simplified while ensuring the service authentication effect.

[0164] In a feasible embodiment of the present application, when the first device needs to call other services (assuming it is a third service) to assist in business processing, after the first device runs the executable file associated with the first service, or after receiving the second authentication basis sent by the security management platform for verifying the calling authority of the second service, the first device can call the third service for auxiliary processing for the intermediate business data obtained after completing the first service processing.

[0165] Specifically, the first device can execute the first service for the object business data associated with the target object, obtain intermediate business data, and determine the third service for processing the intermediate business data in combination with the preset business service process; thereafter, using the signature algorithm built into the executable file associated with the first service, based on the first authentication basis and the request body constructed according to the intermediate business data, generate a first signature result, and splice the request header and request body containing the first signature result to obtain a request to be processed, and send the request to be processed to a third device that provides a third service.

[0166] It should be noted that when the third service serves as the called service of the first service, the first device can execute the first service processing on the object business data associated with the target object, and then call the third service for processing. Specifically, when the first service serves as the called service of the second service, the object business data of the target object can be the data obtained by the second service processing.

[0167] In addition, the device information corresponding to the third device providing the third service may be pre-configured in an executable file associated with the second service, or, if there is a service management device that manages each device providing a service, may be obtained by the second device from the service management device.

[0168] In this way, when the first service on the first device acts as the calling service, it can generate a first signature result based on the first authentication basis and the request body, and request the third device providing the called service to perform authentication verification, so that after completing the authentication verification, it can obtain auxiliary processing of the called service.

[0169] The following is an explanation of the configuration process of the authentication basis from the perspective of the security management device, combined with the accompanying drawings:

[0170] See also Fig. 9 As shown, it is a schematic diagram of the configuration process of the authentication basis executed by the security management device in the implementation of this application. Fig. 9 , taking the configuration of the authentication basis for the first device as an example, the relevant configuration process is described:

[0171] Step 901: The security management device obtains the first authentication basis and development description information set sent by the service publishing device for the first service, stores the correspondence between the development description information set and the first authentication basis, and feeds back a security profile constructed based on the development description information set to the service publishing device.

[0172] Specifically, during the configuration process of the authentication basis, the security management device obtains the first authentication basis and development description information set sent by the service publishing device for the first service, wherein the first authentication basis can be obtained by hashing the executable file associated with the first service by the service publishing device; the development description information set is used to indicate various information related to the first service, such as the service name, service version, file path, and file name, etc.

[0173] Moreover, the security management device stores the correspondence between the development description information set and the first authentication basis, so that the subsequent security management device can determine the first authentication basis corresponding to the first service with the help of a development description information of the first service.

[0174] For example, in the case of storing the correspondence between the development description information set of the first service and the first authentication basis, the security management device can directly determine the first authentication basis of the first service according to the service name of the first service.

[0175] In an embodiment of the present application, when the security management device generates a security configuration file based on a development description information set, the security management device can generate an anti-tampering signature based on private key information and the development description information set, and generate a security configuration file based on the anti-tampering signature and the development description information set; and then feedback the security configuration file to the service publishing device.

[0176] Among them, the private key information and public key information of the security management device itself are pre-configured, and this application does not impose specific restrictions on the key configuration process. Moreover, it should be understood that for a security configuration file containing an anti-tampering signature and a development description information set, the development description information set in the security configuration file is in plain text, but the anti-tampering signature can be used to determine whether the development description information set has been tampered with.

[0177] In this way, the security management device generates an anti-tampering signature based on the development description information set, so that the integrity of the content in the security configuration file can be verified, and whether the development description information set has been tampered with is detected in time, thereby enhancing the security and reliability of the information transmission process.

[0178] Step 902: The security management device receives a target signature result and a security configuration file generated based on a first authentication basis and sent by the first device when the first device runs an executable file associated with the first service.

[0179] Specifically, after the first device runs the executable file associated with the first service and starts the corresponding first service process, the security management device needs to perform process authentication on the first service process, or it can be understood that the security management device needs to perform identity authentication on the first service.

[0180] In an embodiment of the present application, the authentication basis obtained by the security management device includes a target signature result and a security profile generated by the first device based on the first authentication basis, wherein the security profile provided by the first device is generated by the security management device based on a development description information set provided by the service publishing device and sent to the first device via the service publishing device.

[0181] Step 903: The security management device obtains a candidate signature result according to the first authentication basis determined by the development description information set and the corresponding relationship in the security configuration file.

[0182] In an embodiment of the present application, when an anti-tampering signature is included in the security configuration file, when executing step 903, the security management device can use the public key information corresponding to the private key information to verify the anti-tampering signature in the security configuration file, and when it is determined based on the verification result that the development description information set has not been tampered with, a first authentication basis is obtained based on the development description information set and the corresponding relationship; and then a built-in signature algorithm is used to generate a candidate signature result based on the first authentication basis.

[0183] Specifically, after obtaining the security configuration file, the security management device first verifies the tamper-proof signature to verify the integrity and non-tampering of the development description information set; then, when it is determined that the development description information set has not been tampered with, the first authentication basis can be obtained based on the development description information set, and the correspondence between the stored development description information set and the first authentication basis, and then the same signature algorithm is used to generate a candidate signature result based on the first authentication basis, wherein the signature algorithm used is specifically a white-box signature algorithm.

[0184] It should be noted that, in the embodiment of the present application, when the security management device generates the candidate signature result, the information based on it is the same as the information based on which the first device generates the target signature result.

[0185] For example, when the first device uses a built-in signature algorithm to generate a target signature result based on the first authentication basis and the service name, the security management device also uses the internal signature algorithm to generate a candidate signature result based on the found first authentication basis and service name.

[0186] In this way, by verifying the tamper-proof signature in the security configuration file before obtaining the information, it is possible to detect abnormal content in the security configuration file in a timely manner, thereby ensuring the integrity and non-tampering of the development description information set based on the signature verification.

[0187] Step 904: When the security management device determines that the signature verification between the candidate signature result and the target signature result is successful, the second authentication basis of the second service that calls the first service is sent to the first device.

[0188] Specifically, when the security management device determines that the generated candidate signature result is the same as the obtained target signature result, it can be determined that the signature verification between the candidate signature result and the target signature result is successful.

[0189] Furthermore, in order to determine the authentication basis fed back to the first device, the security management device needs to find the target service relationship associated with the first service.

[0190] Specifically, in some feasible implementations, when the security management device directly provides the management function of service call relationships to the outside, the security management device can receive the service call relationships configured by the developer on the authentication management end, and store the service call relationships. Based on this, the security management device can search for the target service relationship associated with the first service as the called service in the stored service call relationships; in other feasible implementations, when the authentication management device provides the management function of service call relationships to the outside, the authentication management device can receive the service call relationships configured by the developer on the authentication management end, and store the service call relationships. Based on this, the security management device can pull the first service as the target service relationship associated with the called service from the authentication management device used to manage the service call relationships.

[0191] It should be noted that the developer is flexible in configuring the service call relationship. Before the security management device specifically determines the target service relationship corresponding to the first service, the service call relationship configured for the first service can be pulled. The target service relationship refers to the service call relationship in which the first service is the called service.

[0192] In this way, the security management device can clarify other services that have a calling relationship with the first service by means of the acquired target service relationship, and thus can determine the service corresponding to the authentication basis configured for the first service.

[0193] Optionally, when the service call relationship is updated, the configuration process of the authentication basis can be re-executed by restarting the relevant service process.

[0194] For example, the first configured service call relationship is that service A calls service B. Then, after service process B is started, the authentication basis of service process A is configured for service process B. Furthermore, after the service call relationship is adjusted to service C calling service B, service process B can be controlled to be restarted on the device providing service B, so that service B can obtain the authentication basis of service C.

[0195] Further, after determining that the second service is the calling service of the first service and the first service is the called service of the second service according to the target calling relationship, the second authentication basis of the second service may be sent to the first device.

[0196] It should be understood that, for the first service, there may be multiple main services corresponding to the first service, and only one is used as an example for schematic illustration in the relevant description of this application.

[0197] In this way, the configuration of the authentication basis can be completed for the first service on the first device, so that in the subsequent business service process, the first service process on the first device can verify the calling authority of the second service process.

[0198] During the configuration process of the authentication basis of the security management device, the same configuration method can be used to configure the authentication basis for devices providing other services, which will not be elaborated in this application.

[0199] The following describes the interaction process involved in the configuration of the authentication basis by taking a specific authentication basis configuration scenario as an example in conjunction with the accompanying drawings:

[0200] See also Fig.10 As shown, it is a schematic diagram of the interaction process when configuring the authentication basis in the embodiment of the present application. Fig.10 , the relevant interaction process is explained:

[0201] Step 1001: A development device publishes a service program of a first service to a service publishing device.

[0202] In a feasible implementation, developers can publish service programs on a publishing system provided by a service publishing device.

[0203] Step 1002: The service publishing device compiles the service program of the first service to obtain an executable file and a development description information set.

[0204] The service publishing device compiles an executable file based on the service program of the first service, performs hash processing on the executable file to obtain a first authentication basis, and compiles a development description information set for the first service, wherein the development description information set includes a process name (ie, service name), version information, etc.

[0205] Step 1003: The service publishing device sends the first authentication basis and development description information set associated with the first service to the security management device through a preset interface.

[0206] Step 1004: The security management device obtains a security configuration file based on the development description information set of the first service, and stores a correspondence between the first authentication basis and the development description information set.

[0207] The security configuration file may be constructed based on the anti-tampering signature and the development description information set obtained after the security configuration device signs the development description information set using a private key.

[0208] Step 1005: The security management device feeds back the security profile of the first service to the service publishing device.

[0209] Step 1006: The development device publishes the service program of the second service to the service publishing device.

[0210] Step 1007: The service publishing device compiles the service program of the second service to obtain an executable file and a development description information set.

[0211] Step 1008: The service publishing device sends the second authentication basis and development description information set associated with the second service to the security management device through a preset interface.

[0212] Step 1009: The security management device obtains a security configuration file based on the development description information set of the second service, and stores a correspondence between the second authentication basis and the development description information set.

[0213] Step 1010: The security management device feeds back a security profile of the second service to the service publishing device.

[0214] The security configuration file is constructed after the security management device signs the development description information set with a private key.

[0215] Step 1011: The development device configures the service call relationship between the second service and the first service with the help of the authentication management terminal.

[0216] Specifically, the developer can perform authorization management on the authentication management terminal installed on the development device to allow the second service to access the first service, that is, to allow the second service to call the first service, or to allow the second service process to call the first service process.

[0217] Step 1012: The security management device stores the service call relationship between the second service and the first service.

[0218] Specifically, the security management device obtains the calling relationship generated on the authentication management end and stores the calling relationship, wherein the service calling relationship is also called the calling relationship or authorization rule, which is used to indicate the called service and the calling service. The calling service is the service that calls other services, and the called service is the service that is called by other services.

[0219] Step 1013: The service publishing device publishes the executable file and security configuration file associated with the first service to the first device.

[0220] Step 1014: The first device starts a first service process.

[0221] Specifically, the first service process is started by the first device through executing an executable file associated with the first service.

[0222] Step 1015: The first device sends a process authentication request to the security management device.

[0223] It should be understood that during the startup phase of the first service process, the first service process white-box signs the first authentication basis and additional information, and then sends the target signature result and the security profile to the security management device for authentication, wherein the additional information is set according to actual processing needs, such as a service name or a timestamp.

[0224] Step 1016: After the security management device determines that the process authentication is successful, it feeds back the second authentication basis for the second service.

[0225] Specifically, during the process of process authentication, the security management device first uses the public key to verify the security configuration file, then obtains the development description information set based on the security configuration file, obtains the first authentication basis from the database according to the development description information set, and then performs a white box signature based on the first authentication basis and additional information to obtain a candidate signature result. When it is determined that the candidate signature result is consistent with the target signature result, the process authentication is determined to be successful.

[0226] Step 1017: The service publishing device publishes the executable file and security configuration file associated with the second service to the second device.

[0227] Step 1018: The second device starts a second service process.

[0228] Specifically, the second service process is started by the second device through executing an executable file associated with the second service.

[0229] Step 1019: The second device sends a process authentication request to the security management device.

[0230] Among them, the relevant process authentication logic is the same as step 1016 and will not be elaborated here.

[0231] Step 1020: After the security management device determines that the process authentication is successful, it feeds back the authentication basis.

[0232] The authentication basis obtained is specifically the authentication basis configured for other services that call the second service. The relevant process authentication process is the same as the above step 1017, and will not be described in detail here.

[0233] It should be understood that the execution of steps 1001-1005 and the execution of steps 1006-1010 do not have an absolute order, and, according to actual processing needs, the processing of steps 1012-1013 may be executed before the execution of step 1001. Fig.10 The processing order described is for illustrative purposes only.

[0234] For further information, see Fig.11 As shown, it is a schematic diagram of the interactive process of service authentication in the embodiment of the present application. Fig.11 , explaining the interaction process involved in service authentication:

[0235] Step 1101: The second service process on the second device generates a request body based on the business data to be processed after the second service processing, hashes the request body to obtain a request body hash, and generates a white box signature based on the request body hash and the second authentication basis.

[0236] Step 1102: The second service process on the second device sends a business processing request obtained by concatenating the request header and the request body containing the white-box signature to the first service process on the first device.

[0237] Specifically, the second service process on the second device can perform a white-box signature on the request body hash, the second authentication basis, and the service name, and then place the signature result in the request header; or, it can use the built-in white-box algorithm to sign its own second authentication basis and request body, and then place the signature result in the request header.

[0238] Step 1103: The first service process on the first device generates a white-box signature based on the request body of the business processing request and the second authentication basis stored in the memory, and processes the pending business data in the business processing request after completing the verification of the white-box signature.

[0239] Specifically, after receiving the business processing request, the first service process on the first device can find the corresponding second authentication basis in the memory according to the service name of the second service, and then complete the verification of the white box signature.

[0240] Thus, in summary, in the configuration process of the authentication basis proposed in the present application, the authentication basis corresponding to the service is obtained by hashing the executable file associated with the service; and, when performing service authentication, authentication verification between services is performed based on the white-box signature algorithm. In addition, the technical solution proposed in the present application is equivalent to proposing an authentication protocol based on white-box signatures. In the authentication basis configuration and authentication process implemented by means of white-box signatures, the security management device only needs to issue the authentication basis after completing the signature verification, so lightweight data issuance can be achieved. Moreover, since the white-box signature algorithm is shielded from the outside, the configuration process of the authentication basis has extremely high security. In addition, since the process authentication is performed before issuing the authentication basis, the privacy and security of the authentication basis can be maintained, and the flexibility of the service authentication capability can be maintained.

[0241] It should be understood that in the technical solution proposed in the present application, at the service publishing stage, the service publishing device uses the hash value of the compiled product of the service program, that is, the authentication basis, as the identity identification key of the service process, and stores it in the security management device; then, when sending a request, the calling service process uses its own authentication basis and combines it with the built-in white-box signature algorithm to perform a white-box signature on information such as the request elements, so that after the called service process receives the request, it can verify the legitimacy of the service call based on the pre-stored authentication basis of the calling service process.

[0242] Based on the same inventive concept, refer to Fig.12 As shown, it is a schematic diagram of the logical structure of a configuration device for authentication basis in an embodiment of the present application. The configuration device 1200 for authentication basis includes a response unit 1201, an operation unit 1202, and a receiving unit 1203, wherein:

[0243] The response unit 1201 is used to obtain an executable file and a security configuration file associated with the first service in response to a release instruction of the service release device for the first service, and obtain a first authentication basis configured for the first service for authenticating the service call authority of the first service; wherein the security configuration file is constructed by the security management device based on the development description information set sent by the service release device;

[0244] The running unit 1202 is used to run the executable file and send the security configuration file and the target signature result generated based on the first authentication basis to the security management device;

[0245] Receiving unit 1203 is used to receive the second authentication basis sent by the security management device for identifying the service calling authority of the second service after the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis; wherein the first service is configured to be called by the second service.

[0246] Optionally, after running the executable file, or after receiving the second authentication basis sent by the security management platform for verifying the calling authority of the second service, the device further includes an execution unit 1204, which is used to:

[0247] Execute the first service for the object business data associated with the target object to obtain the intermediate business data, and determine the third service for processing the intermediate business data in combination with the preset business service process;

[0248] A signature algorithm built into the executable file associated with the first service is used to generate a first signature result based on the first authentication basis and the request body constructed according to the intermediate business data, and the request header and request body containing the first signature result are concatenated to obtain a request to be processed, and the request to be processed is sent to a third device providing a third service.

[0249] Optionally, after receiving the second authentication basis sent by the security management device for identifying the calling authority of the second service, the apparatus further includes a processing unit 1205, and the processing unit 1205 is used to:

[0250] receiving a service processing request sent by a second device providing a second service; the request header of the service processing request includes: a second signature result generated based on the second authentication information and the request body of the service processing request using a signature algorithm built into an executable file of the second service;

[0251] Using a signature algorithm built into the executable file of the first service, based on the request body in the business processing request and the stored second authentication basis, to generate a signature result to be verified;

[0252] When it is determined that the signature verification between the second signature result and the signature result to be verified is successful, business processing is performed on the business data to be processed in the request body.

[0253] Optionally, when obtaining the first authentication basis configured for the first service and used to identify the service calling authority of the first service, the response unit 1201 is used to perform any one of the following operations:

[0254] Obtaining a first authentication basis generated by a service publishing device after hashing the executable file;

[0255] A hash process is performed on the executable file to obtain a first authentication basis for the first service.

[0256] Optionally, when the executable file is run to send the security configuration file and the target signature result generated based on the first authentication basis to the security management device, the running unit 1202 is used to:

[0257] Run the executable file, start the first service process, and generate a target signature result based on the first authentication basis according to the built-in signature algorithm;

[0258] An interactive process for communicating with a security management device is started, and a security configuration file and a target signature result are sent to the security management device through the interactive process.

[0259] Based on the same inventive concept, refer to Fig.13As shown, it is a schematic diagram of the logical structure of another authentication basis configuration device in an embodiment of the present application. The authentication basis configuration device 1300 includes an acquisition unit 1301, a receiving unit 1302, an obtaining unit 1303, and a determining unit 1304, wherein:

[0260] The acquisition unit 1301 is used to acquire the first authentication basis and the development description information set sent by the service publishing device for the first service, store the corresponding relationship between the development description information set and the first authentication basis, and feed back a security profile constructed based on the development description information set to the service publishing device;

[0261] The receiving unit 1302 is configured to receive a target signature result and a security configuration file generated based on a first authentication basis and sent by the first device when the first device runs an executable file associated with the first service;

[0262] The obtaining unit 1303 is used to obtain a candidate signature result according to the first authentication basis determined by the development description information set and the corresponding relationship in the security configuration file;

[0263] The determining unit 1304 is configured to send a second authentication basis of the second service that calls the first service to the first device when it is determined that the signature verification between the candidate signature result and the target signature result is successful.

[0264] Optionally, when feeding back a security configuration file constructed based on the development description information set to the service publishing device, the acquiring unit 1301 is used to:

[0265] Generate a tamper-proof signature based on the private key information and the development description information set, and generate a security configuration file based on the tamper-proof signature and the development description information set;

[0266] Publish the device feedback security profile to the service.

[0267] Optionally, when a candidate signature result is obtained according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship, the obtaining unit 1301 is used to:

[0268] Using the public key information corresponding to the private key information, verifying the tamper-proof signature in the security configuration file, and when determining that the development description information set has not been tampered with based on the verification result, obtaining the first authentication basis based on the development description information set and the corresponding relationship;

[0269] A built-in signature algorithm is used to generate a candidate signature result based on the first authentication basis.

[0270] Optionally, after determining that the signature verification between the candidate signature result and the target signature result is successful, before sending the second authentication basis of the second service that calls the first service to the first device, the apparatus further includes a search unit 1305, and the search unit 1305 is used to perform any one of the following:

[0271] In the stored service call relationships, searching for a target service relationship associated with the first service as the called service;

[0272] The first service is pulled from an authentication management device for managing service calling relationships as a target service relationship associated with the called service.

[0273] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0274] After introducing the configuration method and device of the authentication basis according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0275] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0276] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. Fig.14 As shown, it is a schematic diagram of the hardware structure of an electronic device using an embodiment of the present application. In one embodiment, the electronic device may be a first device. In this embodiment, the structure of the electronic device may be as follows: Fig.14 As shown, it includes a memory 1401 , a communication module 1403 and one or more processors 1402 .

[0277] The memory 1401 is used to store computer programs executed by the processor 1402. The memory 1401 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0278] The memory 1401 may be a volatile memory, such as a random-access memory (RAM); the memory 1401 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 1401 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1401 may be a combination of the above memories.

[0279] The processor 1402 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 1402 is used to implement the configuration method of the authentication basis when calling the computer program stored in the memory 1401.

[0280] The communication module 1403 is used to communicate with the client device and the server.

[0281] The specific connection medium between the memory 1401, the communication module 1403 and the processor 1402 is not limited in the embodiment of the present application. Fig.14 In the embodiment, the memory 1401 and the processor 1402 are connected via a bus 1404. Fig.14 The connections between the other components are only for illustration and are not intended to be limiting. The bus 1404 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig.14 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0282] The memory 1401 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the method for generating the prompt audio in the embodiment of the present application. The processor 1402 is used to execute the configuration method of the above-mentioned authentication basis, such as Figure 5 shown.

[0283] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. Fig.15 As shown, it is a schematic diagram of the hardware structure of another electronic device using an embodiment of the present application. In one embodiment, the electronic device may be a security management device. In this embodiment, the structure of the electronic device may be as follows: Fig.15As shown, it includes a memory 1501 , a communication module 1503 and one or more processors 1502 .

[0284] The memory 1501 is used to store computer programs executed by the processor 1502. The memory 1501 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0285] The memory 1501 may be a volatile memory, such as a random-access memory (RAM); the memory 1501 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 1501 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1501 may be a combination of the above memories.

[0286] The processor 1502 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 1502 is used to implement the configuration method of the authentication basis when calling the computer program stored in the memory 1501.

[0287] The communication module 1503 is used to communicate with the client device and the server.

[0288] The specific connection medium between the memory 1501, the communication module 1503 and the processor 1502 is not limited in the embodiment of the present application. Fig.15 In the embodiment, the memory 1501 and the processor 1502 are connected via a bus 1504. The bus 1504 is connected to the processor 1502 via a bus 1504. Fig.15 The connections between the other components are described with bold lines, which are only for illustration and are not intended to be limiting. The bus 1504 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig.15 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0289] The memory 1501 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the method for generating the prompt audio in the embodiment of the present application. The processor 1502 is used to execute the configuration method of the above-mentioned authentication basis, such as Fig. 9 shown.

[0290] In some possible implementations, various aspects of the method for configuring the authentication basis provided in the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps in the method for configuring the authentication basis according to various exemplary implementations of the present application described above in this specification. For example, the electronic device may execute the following steps: Figure 5 or the steps shown in 9.

[0291] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0292] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0293] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0294] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0295] The computer program for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The computer program can be executed entirely on the user electronic device, partially on the user electronic device, as a separate software package, partially on the user electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0296] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0297] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0298] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0299] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0300] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0301] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for configuring authentication basis, characterized in that: A first device for providing a first service includes: In response to a release instruction from a service publishing device for the first service, an executable file and a security configuration file associated with the first service are obtained, as well as a first authentication basis configured for the first service and used to identify the service call authority of the first service; wherein the security configuration file is constructed by a security management device based on a development description information set sent by the service publishing device; Running the executable file, and sending the security configuration file and the target signature result generated based on the first authentication basis to the security management device; After the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis, the second authentication basis sent by the security management device is received for identifying the service calling authority of the second service; wherein the first service is configured to be called by the second service.

2. The method according to claim 1, characterized in that After running the executable file, or after receiving the second authentication basis sent by the security management platform for verifying the calling authority of the second service, the method further includes: Execute a first service for object business data associated with the target object to obtain intermediate business data, and determine a third service for processing the intermediate business data in combination with a preset business service process; A signature algorithm built into the executable file associated with the first service is used to generate a first signature result based on the first authentication basis and the request body constructed according to the intermediate business data, and the request header containing the first signature result and the request body are concatenated to obtain a request to be processed, and the request to be processed is sent to a third device that provides the third service.

3. The method according to claim 1, characterized in that After receiving the second authentication basis sent by the security management device for identifying the calling authority of the second service, the method further includes: receiving a service processing request sent by a second device providing the second service; wherein the request header of the service processing request includes: a second signature result generated based on the second authentication information and the request body of the service processing request using a signature algorithm built into an executable file of the second service; Using the signature algorithm built into the executable file of the first service, based on the request body in the business processing request and the stored second authentication basis, to generate a signature result to be verified; When it is determined that the signature verification between the second signature result and the signature result to be verified is successful, business processing is performed on the business data to be processed in the request body.

4. The method according to claim 1, characterized in that When obtaining the first authentication basis configured for the first service and used to identify the service calling authority of the first service, any one of the following operations is performed: Obtaining a first authentication basis generated by the service publishing device after hashing the executable file; A hash process is performed on the executable file to obtain a first authentication basis for the first service.

5. The method according to any one of claims 1 to 4, characterized in that: The running of the executable file and sending the security configuration file and the target signature result generated based on the first authentication basis to the security management device include: Running the executable file, starting the first service process, and generating a target signature result based on the first authentication basis according to a built-in signature algorithm; An interactive process for communicating with the security management device is started, and the security configuration file and the target signature result are sent to the security management device through the interactive process.

6. A method for configuring authentication basis, characterized in that: Applied to security management equipment, including: Obtaining a first authentication basis and a development description information set sent by a service publishing device for a first service, storing a corresponding relationship between the development description information set and the first authentication basis, and feeding back a security profile constructed based on the development description information set to the service publishing device; receiving a target signature result and the security configuration file generated based on the first authentication basis and sent by the first device when the first device runs the executable file associated with the first service; Obtaining a candidate signature result according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship; When it is determined that the signature verification between the candidate signature result and the target signature result is successful, a second authentication basis of a second service that calls the first service is sent to the first device.

7. The method according to claim 6, characterized in that Feedback to the service publishing device of a security configuration file constructed based on the development description information set includes: Generate a tamper-proof signature based on private key information and the development description information set, and generate a security configuration file based on the tamper-proof signature and the development description information set; Feedback the security configuration file to the service publishing device.

8. The method according to claim 7, characterized in that The step of obtaining a candidate signature result according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship includes: Using the public key information corresponding to the private key information, verifying the tamper-proof signature in the security configuration file, and when determining that the development description information set has not been tampered with according to the verification result, obtaining a first authentication basis according to the development description information set and the corresponding relationship; A built-in signature algorithm is used to generate a candidate signature result based on the first authentication basis.

9. The method according to any one of claims 6 to 8, characterized in that: After determining that the signature verification between the candidate signature result and the target signature result is successful, before sending the second authentication basis of the second service that calls the first service to the first device, the method further includes any one of the following: In the stored service call relationships, searching for a target service relationship associated with the first service when the first service is used as a called service; The first service is pulled from an authentication management device used to manage service calling relationships as a target service relationship associated with the called service.

10. A configuration system for authentication basis, characterized in that: The configuration system includes: a first device providing a first service, a service publishing device, and a security management device; The service publishing device is used to send a first authentication basis and a development description information set configured for a first service for identifying the service calling authority of the first service to the security management device, and publish the executable file associated with the first service and the security configuration file generated by the security management device to the first device; The first device is configured to run the executable file, send the security configuration file and the target signature result generated based on the first authentication basis to the security management device, and receive a second authentication basis for authenticating the service calling authority of the second service sent by the security management device after completing the signature verification, wherein the second service is configured to be called by the first service; The security management device is used to store the correspondence between the development description information set and the first authentication basis, and to feed back a security profile constructed based on the development description information set to the service publishing device; obtain a candidate signature result based on the first authentication basis determined by the development description information set in the security profile and the correspondence, and determine the second authentication basis for the second service after completing the signature verification of the candidate signature result and the target signature result.

11. The system according to claim 10, characterized in that The system further includes: a second device providing a second service; The second device is used to execute the second service for the object business data associated with the target object after completing the configuration of the authentication basis for the second service, obtain the business data to be processed, and determine the first service for processing the business data to be processed in combination with the preset business service process; use the signature algorithm built into the executable file associated with the second service, based on the corresponding second authentication basis and the request body constructed according to the business data to be processed, generate a second signature result, and splice the request header containing the second signature result and the request body to obtain a business processing request, and send the business processing request to the first device.

12. The system according to claim 10 or 11, characterized in that The system further includes: a third device providing a third service; The third device is used to receive a pending request sent by the first device after completing the configuration of the authentication basis for the third service; wherein the request header of the pending request includes: a first signature result generated based on the first authentication information and the request body of the pending request using the signature algorithm built into the executable file of the first service; a signature result to be verified is generated based on the request body and the stored first authentication basis using the signature algorithm built into the executable file of the third service; and when it is determined that the signature verification between the first signature result and the signature result to be verified is successful, business processing is performed on the intermediate business data in the request body.

13. A configuration device for authentication basis, characterized in that: include: A response unit, configured to obtain, in response to a release instruction of the service publishing device for the first service, an executable file and a security configuration file associated with the first service, and obtain a first authentication basis configured for the first service for identifying the service call authority of the first service; wherein the security configuration file is constructed by the security management device based on the development description information set sent by the service publishing device; An operating unit, configured to operate the executable file and send the security configuration file and a target signature result generated based on the first authentication basis to the security management device; A receiving unit is used to receive a second authentication basis sent by the security management device for identifying the service calling authority of the second service after the security management device completes the signature verification of the target signature result based on the security configuration file and the correspondence between the stored development description information set and the first authentication basis; wherein the first service is configured to be called by the second service.

14. A configuration device for authentication basis, characterized in that: include: An acquisition unit, configured to acquire a first authentication basis and a development description information set sent by a service publishing device for a first service, store a correspondence between the development description information set and the first authentication basis, and feed back a security profile constructed based on the development description information set to the service publishing device; a receiving unit, configured to receive a target signature result and the security configuration file generated based on the first authentication basis and sent by the first device when the first device runs the executable file associated with the first service; an obtaining unit, configured to obtain a candidate signature result according to the first authentication basis determined by the development description information set in the security configuration file and the corresponding relationship; The determining unit is configured to send a second authentication basis of a second service that calls the first service to the first device when it is determined that the signature verification between the candidate signature result and the target signature result is successful.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images